./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1756522962 <...> Warning: Permanently added '10.128.1.62' (ED25519) to the list of known hosts. execve("./syz-executor1756522962", ["./syz-executor1756522962"], 0x7ffc72137a40 /* 10 vars */) = 0 brk(NULL) = 0x55557dbe7000 brk(0x55557dbe7d00) = 0x55557dbe7d00 arch_prctl(ARCH_SET_FS, 0x55557dbe7380) = 0 set_tid_address(0x55557dbe7650) = 291 set_robust_list(0x55557dbe7660, 24) = 0 rseq(0x55557dbe7ca0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1756522962", 4096) = 28 getrandom("\xe7\x46\xdc\x14\xbc\x7c\x50\x75", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55557dbe7d00 brk(0x55557dc08d00) = 0x55557dc08d00 brk(0x55557dc09000) = 0x55557dc09000 mprotect(0x7fa746345000, 16384, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18executing program ) = 18 socket(AF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 3 openat(AT_FDCWD, "/dev/net/tun", O_RDONLY) = 4 ioctl(4, TUNSETIFF, 0x200000000040) = 0 socket(AF_NETLINK, SOCK_RAW, 0) = 5 socket(AF_UNIX, SOCK_STREAM, 0) = 6 ioctl(6, SIOCGIFINDEX, {ifr_name="syzkaller0", ifr_ifindex=15}) = 0 sendmsg(5, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x38\x00\x00\x00\x24\x00\x41\x65\x2a\xbd\x70\x00\xff\xff\xff\xff\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\xf1\xff\xff\xff\xff\xff\x00\x00\x00\x00\x0b\x00\x01\x00\x6d\x75\x6c\x74\x69\x71\x00\x00\x08\x00\x02\x00\x00\x00\x00\x00", iov_len=56}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 56 [ 26.100021][ T24] audit: type=1400 audit(1743874316.820:66): avc: denied { execmem } for pid=291 comm="syz-executor175" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 26.114778][ T291] ================================================================== [ 26.127306][ T291] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0xbb8/0x3630 [ 26.131085][ T24] audit: type=1400 audit(1743874316.830:67): avc: denied { read } for pid=133 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 26.135259][ T291] Read of size 8 at addr ffff88810c1c7fc0 by task syz-executor175/291 [ 26.164234][ T291] [ 26.166411][ T291] CPU: 1 PID: 291 Comm: syz-executor175 Not tainted 5.10.234-syzkaller-00033-g094fc3778d6b #0 [ 26.176475][ T291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 26.186766][ T291] Call Trace: [ 26.189947][ T291] dump_stack_lvl+0x1e2/0x24b [ 26.194373][ T291] ? bfq_pos_tree_add_move+0x43b/0x43b [ 26.199660][ T291] ? panic+0x812/0x812 [ 26.203587][ T291] print_address_description+0x81/0x3b0 [ 26.209238][ T291] kasan_report+0x179/0x1c0 [ 26.213572][ T291] ? tc_setup_flow_action+0xbb8/0x3630 [ 26.219736][ T291] ? tc_setup_flow_action+0xbb8/0x3630 [ 26.225123][ T291] __asan_report_load8_noabort+0x14/0x20 [ 26.230706][ T291] tc_setup_flow_action+0xbb8/0x3630 [ 26.235901][ T291] ? __kmalloc+0x1aa/0x330 [ 26.240264][ T291] ? flow_rule_alloc+0x30/0x2b0 [ 26.244944][ T291] mall_replace_hw_filter+0x394/0xc10 [ 26.250149][ T291] ? mall_set_parms+0x440/0x440 [ 26.254829][ T291] ? tcf_exts_destroy+0xb0/0xb0 [ 26.259528][ T291] ? pcpu_memcg_post_alloc_hook+0x1c8/0x360 [ 26.265334][ T291] ? pcpu_alloc+0xfa0/0x1420 [ 26.269761][ T291] ? mall_set_parms+0x4b/0x440 [ 26.274561][ T291] ? mall_set_parms+0x1a2/0x440 [ 26.279444][ T291] mall_change+0x573/0x7a0 [ 26.283708][ T291] ? __kasan_check_write+0x14/0x20 [ 26.288717][ T291] ? mall_get+0xb0/0xb0 [ 26.292720][ T291] ? tcf_chain_tp_insert_unique+0xa90/0xbb0 [ 26.298711][ T291] tc_new_tfilter+0x168e/0x1dc0 [ 26.303393][ T291] ? mall_get+0xb0/0xb0 [ 26.307388][ T291] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.312878][ T291] ? security_capable+0x87/0xb0 [ 26.317543][ T291] ? ns_capable+0x89/0xe0 [ 26.321713][ T291] ? netlink_net_capable+0x125/0x160 [ 26.326826][ T291] ? tcf_gate_entry_destructor+0x20/0x20 [ 26.332296][ T291] rtnetlink_rcv_msg+0x77a/0xc50 [ 26.337087][ T291] ? is_bpf_text_address+0x172/0x190 [ 26.342199][ T291] ? rtnetlink_bind+0x80/0x80 [ 26.346924][ T291] ? arch_stack_walk+0xf3/0x140 [ 26.351596][ T291] ? stack_trace_save+0x113/0x1c0 [ 26.356453][ T291] ? stack_trace_snprint+0xf0/0xf0 [ 26.361401][ T291] ? avc_has_perm+0x14d/0x400 [ 26.365934][ T291] ? memcpy+0x56/0x70 [ 26.369742][ T291] ? avc_has_perm+0x275/0x400 [ 26.374255][ T291] ? __kasan_slab_alloc+0xb1/0xe0 [ 26.379110][ T291] ? slab_post_alloc_hook+0x61/0x2f0 [ 26.384243][ T291] ? kmem_cache_alloc+0x168/0x2e0 [ 26.389110][ T291] ? avc_has_perm_noaudit+0x240/0x240 [ 26.394304][ T291] ? iov_iter_advance+0x258/0xb20 [ 26.399161][ T291] netlink_rcv_skb+0x1cf/0x410 [ 26.403761][ T291] ? rtnetlink_bind+0x80/0x80 [ 26.408267][ T291] ? netlink_ack+0xb30/0xb30 [ 26.412703][ T291] ? __netlink_lookup+0x37b/0x3a0 [ 26.417554][ T291] rtnetlink_rcv+0x1c/0x20 [ 26.421809][ T291] netlink_unicast+0x8df/0xac0 [ 26.426410][ T291] ? netlink_detachskb+0x90/0x90 [ 26.431184][ T291] ? security_netlink_send+0x7b/0xa0 [ 26.436462][ T291] netlink_sendmsg+0xa46/0xd00 [ 26.440994][ T291] ? netlink_getsockopt+0x5c0/0x5c0 [ 26.446698][ T291] ? security_socket_sendmsg+0x82/0xb0 [ 26.452066][ T291] ? netlink_getsockopt+0x5c0/0x5c0 [ 26.457366][ T291] ____sys_sendmsg+0x59e/0x8f0 [ 26.461946][ T291] ? __sys_sendmsg_sock+0x40/0x40 [ 26.466939][ T291] ? import_iovec+0xe5/0x120 [ 26.471358][ T291] ___sys_sendmsg+0x252/0x2e0 [ 26.475878][ T291] ? __sys_sendmsg+0x280/0x280 [ 26.480466][ T291] ? finish_task_switch+0x130/0x5a0 [ 26.485594][ T291] ? __schedule+0xbee/0x1330 [ 26.490015][ T291] ? __kasan_check_write+0x14/0x20 [ 26.495048][ T291] ? _raw_spin_lock_irq+0xa5/0x1b0 [ 26.500144][ T291] ? __kasan_check_read+0x11/0x20 [ 26.505432][ T291] ? __fdget+0x179/0x240 [ 26.509510][ T291] __se_sys_sendmsg+0x1b1/0x280 [ 26.514193][ T291] ? _raw_spin_unlock_irq+0x4e/0x70 [ 26.520137][ T291] ? __x64_sys_sendmsg+0x90/0x90 [ 26.525070][ T291] ? fpu__clear_all+0x20/0x20 [ 26.529582][ T291] __x64_sys_sendmsg+0x7b/0x90 [ 26.534271][ T291] do_syscall_64+0x34/0x70 [ 26.540124][ T291] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.545901][ T291] RIP: 0033:0x7fa7462d27a9 [ 26.550170][ T291] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 26.570019][ T291] RSP: 002b:00007fff741f0708 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 26.578257][ T291] RAX: ffffffffffffffda RBX: 00007fff741f08d8 RCX: 00007fa7462d27a9 [ 26.586064][ T291] RDX: 0000000000000000 RSI: 0000200000000580 RDI: 0000000000000003 [ 26.593876][ T291] RBP: 00007fa746345610 R08: 0000000000000004 R09: 00007fff741f08d8 [ 26.601878][ T291] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 26.609695][ T291] R13: 00007fff741f08c8 R14: 0000000000000001 R15: 0000000000000001 [ 26.617496][ T291] [ 26.619677][ T291] Allocated by task 291: [ 26.623863][ T291] ____kasan_kmalloc+0xdb/0x110 [ 26.628532][ T291] __kasan_kmalloc+0x9/0x10 [ 26.632879][ T291] __kmalloc+0x1aa/0x330 [ 26.636948][ T291] tcf_idr_create+0x5f/0x770 [ 26.641375][ T291] tcf_idr_create_from_flags+0x5f/0x70 [ 26.646668][ T291] tcf_gact_init+0x373/0x6e0 [ 26.651234][ T291] tcf_action_init_1+0x584/0x830 [ 26.655984][ T291] tcf_action_init+0x2b5/0x800 [ 26.660591][ T291] tcf_exts_validate+0x232/0x540 [ 26.665354][ T291] mall_set_parms+0x4b/0x440 [ 26.669785][ T291] mall_change+0x49e/0x7a0 [ 26.674030][ T291] tc_new_tfilter+0x168e/0x1dc0 [ 26.678714][ T291] rtnetlink_rcv_msg+0x77a/0xc50 [ 26.683487][ T291] netlink_rcv_skb+0x1cf/0x410 [ 26.688097][ T291] rtnetlink_rcv+0x1c/0x20 [ 26.692353][ T291] netlink_unicast+0x8df/0xac0 [ 26.696950][ T291] netlink_sendmsg+0xa46/0xd00 [ 26.701545][ T291] ____sys_sendmsg+0x59e/0x8f0 [ 26.706141][ T291] ___sys_sendmsg+0x252/0x2e0 [ 26.710656][ T291] __se_sys_sendmsg+0x1b1/0x280 [ 26.715340][ T291] __x64_sys_sendmsg+0x7b/0x90 [ 26.719945][ T291] do_syscall_64+0x34/0x70 [ 26.724207][ T291] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.729927][ T291] [ 26.732091][ T291] The buggy address belongs to the object at ffff88810c1c7f00 [ 26.732091][ T291] which belongs to the cache kmalloc-192 of size 192 [ 26.745981][ T291] The buggy address is located 0 bytes to the right of [ 26.745981][ T291] 192-byte region [ffff88810c1c7f00, ffff88810c1c7fc0) [ 26.759426][ T291] The buggy address belongs to the page: [ 26.765013][ T291] page:ffffea00043071c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10c1c7 [ 26.775158][ T291] flags: 0x4000000000000200(slab) [ 26.780110][ T291] raw: 4000000000000200 ffffea00042fb9c0 0000000b0000000b ffff888100043380 [ 26.788517][ T291] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 26.797015][ T291] page dumped because: kasan: bad access detected [ 26.803276][ T291] page_owner tracks the page as allocated [ 26.809012][ T291] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 64, ts 4863819174, free_ts 4746967728 [ 26.824495][ T291] prep_new_page+0x166/0x180 [ 26.828904][ T291] get_page_from_freelist+0x2d8c/0x2f30 [ 26.834287][ T291] __alloc_pages_nodemask+0x435/0xaf0 [ 26.839509][ T291] new_slab+0x80/0x400 [ 26.843412][ T291] ___slab_alloc+0x302/0x4b0 [ 26.847821][ T291] __slab_alloc+0x63/0xa0 [ 26.852004][ T291] kmem_cache_alloc_trace+0x1bd/0x2e0 [ 26.857217][ T291] alloc_fs_context+0x64/0x680 [ 26.861817][ T291] fs_context_for_mount+0x24/0x30 [ 26.866762][ T291] do_new_mount+0x15c/0xb30 [ 26.871093][ T291] path_mount+0x56f/0xcb0 [ 26.875268][ T291] __se_sys_mount+0x2c4/0x3b0 [ 26.879768][ T291] __x64_sys_mount+0xbf/0xd0 [ 26.884191][ T291] do_syscall_64+0x34/0x70 [ 26.888445][ T291] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.894341][ T291] page last free stack trace: [ 26.898977][ T291] free_unref_page_prepare+0x2ae/0x2d0 [ 26.905011][ T291] free_the_page+0x9e/0x370 [ 26.909322][ T291] __free_pages+0x67/0xc0 [ 26.913452][ T291] __vunmap+0x7c1/0x940 [ 26.917646][ T291] vfree+0x5c/0x80 [ 26.921366][ T291] sel_write_load+0x247/0x550 [ 26.925873][ T291] vfs_write+0x36a/0xe70 [ 26.929948][ T291] ksys_write+0x199/0x2c0 [ 26.934112][ T291] __x64_sys_write+0x7b/0x90 [ 26.938544][ T291] do_syscall_64+0x34/0x70 [ 26.942788][ T291] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.948515][ T291] [ 26.950697][ T291] Memory state around the buggy address: [ 26.956173][ T291] ffff88810c1c7e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 26.964432][ T291] ffff88810c1c7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.972322][ T291] >ffff88810c1c7f80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 26.980219][ T291] ^ [ 26.986209][ T291] ffff88810c1c8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 26.994101][ T291] ffff88810c1c8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc sendmsg(3, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x84\x00\x00\x00\x2c\x00\x27\x0d\x29\xbd\x30\x00\x02\x00\x00\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x07\x00\x00\x00\x0d\x00\x01\x00\x6d\x61\x74\x63\x68\x61\x6c\x6c\x00\x00\x00\x00\x50\x00\x02\x00\x4c\x00\x02\x00\x48\x00\x01\x00\x09\x00\x01\x00\x67\x61\x63\x74\x00\x00\x00\x00\x1c\x00\x02\x80\x18\x00\x02\x00\x40\x00\x00\x00\x00\x04\x00\x00\x05\x00\x00\x00\x80\x00\x00\x00"..., iov_len=132}], msg_iovlen=1, msg_controllen=0, msg_flags=MSG_PROBE}, 0) = 132 exit_group(0) = ? [ 27.002174][ T291] ================================================================== [ 27.010061][ T291] Disabling lock debugging due to kernel taint +++ exited with 0 +++